Top 50 Linux Commands Every DevOps Engineer Must Know

The Complete Hands-On Terminal Reference Guide for System Administration, Troubleshooting, Networking, Automation & Cloud Operations

Production DevOps Guide | Linux System Administration & CLI Mastery

🐧 Why Linux Command-Line Mastery is Critical for DevOps

Linux is the operating system backbone of modern cloud infrastructure. Over 90% of cloud servers on AWS, Azure, GCP, and Kubernetes run Linux distributions (Ubuntu, RHEL, Amazon Linux, Debian). Whether you are troubleshooting container crashes, inspecting system resources, configuring network firewalls, or writing CI/CD automation scripts, mastering CLI utilities is an essential core skill for every DevOps and SRE professional.

System Hardware & OS
File System & Security
Process Monitoring
Networking & Ports
Text Parsing & Logs
DevOps Standard: Every command in this guide includes production-ready flags, realistic usage examples, and copy-pasteable syntax blocks for your daily cloud operations.

💻 Category 1: System Information & Hardware Inspection

Before deploying applications or debugging resource bottlenecks, you must inspect hardware specs, kernel versions, and storage utilization.

1. uname — Kernel & OS Architecture Information

Prints system details, kernel release, and hardware architecture.

Terminal Command
# Display all kernel and OS system info
uname -a

# Output example:
# Linux devops-server 5.15.0-101-generic #111-Ubuntu SMP x86_64 GNU/Linux

2. hostname / hostnamectl — Host Network Identification

Inspect or modify the system's hostname and view IP address bindings.

Terminal Command
# Show detailed system host and OS chassis info
hostnamectl

# Display internal IP address associated with the host
hostname -I

3. uptime — Server Running Time & Load Averages

Displays how long the server has been running, logged-in users, and system load averages over 1, 5, and 15 minutes.

Terminal Command
# Pretty print system uptime duration
uptime -p

# Standard output showing load averages:
# 14:32:01 up 45 days, 3:12,  2 users,  load average: 0.15, 0.22, 0.18

4. df — Disk Space Filesystem Consumption

Inspects total, used, and available storage space across mounted file systems.

Terminal Command
# Human-readable format showing filesystem type (-hT)
df -hT

5. du — Directory & File Space Estimation

Calculates disk space consumed by specific folders and identifies space-hogging logs.

Terminal Command
# Find top 10 largest directories in /var/log
du -sh /var/log/* | sort -hr | head -n 10

6. free — Memory (RAM & Swap) Inspection

Displays total, used, free, and available physical memory and swap space.

Terminal Command
# Display memory stats in Gigabytes/Megabytes with totals (-h -t)
free -h -t

7. lscpu & lsblk — CPU Cores & Block Storage Devices

Lists CPU architecture, core counts, threads, and attached block devices (EBS volumes/disks).

Terminal Command
# View CPU details
lscpu

# View attached disk partitions and filesystems
lsblk -f

📁 Category 2: File Navigation, Manipulation & Archiving

Navigating directory trees, creating nested directories, and archiving logs are fundamental daily tasks.

8. ls — Directory Listing & Metadata Inspection

Lists files and directories with permissions, owner, size, and modification timestamps.

Terminal Command
# List all files including hidden ones (-a), long format (-l), sorted by size (-S), human readable (-h)
ls -laSh /var/log

9. find — Advanced File Search Engine

Recursively searches directories based on file name, modification time, size, or permissions.

Terminal Command
# Find all .log files in /var/log modified in the last 7 days exceeding 50MB
find /var/log -type f -name "*.log" -mtime -7 -size +50M

10. which & whereis — Locate Executable Binary Paths

Finds the absolute file path of CLI executables and binaries.

Terminal Command
# Find binary path of docker and kubectl
which docker
whereis kubectl

11. mkdir — Create Directory Trees

Creates single or nested directory hierarchies in a single command.

Terminal Command
# Create nested directory tree with parent folders (-p)
mkdir -p /opt/app/{bin,conf,logs,data}

12. rm — Remove Files & Directories

Deletes files or directories recursively and forcefully.

Terminal Command
# Safely remove temporary build directory recursively
rm -rf /tmp/build_cache/

13. cp & mv — Copy & Move/Rename Operations

Copies or moves files and folders while preserving mode, ownership, and timestamps.

Terminal Command
# Copy directory recursively preserving attributes (-a)
cp -a /etc/nginx /etc/nginx_backup_$(date +%F)

# Rename file
mv config.tmp config.env

14. ln — Create Symbolic & Hard Links

Creates shortcuts (symlinks) pointing to files or directories across the filesystem.

Terminal Command
# Create symbolic link for Nginx site configuration
ln -s /etc/nginx/sites-available/app.conf /etc/nginx/sites-enabled/app.conf

15. tar — Archive & Compress Files

Packs multiple files into a single compressed .tar.gz archive or extracts them.

Terminal Command
# Create compressed archive
tar -czvf app_logs.tar.gz /var/log/app/

# Extract archive to target folder
tar -xzvf app_logs.tar.gz -C /opt/logs/

🔍 Category 3: Text Searching, Parsing & Log Auditing

Log inspection and text processing are central to troubleshooting production outages and auditing API traffic.

16. grep — Regex Text Search

Searches text patterns in files or command outputs using regular expressions.

Terminal Command
# Search for ERROR or CRITICAL case-insensitively in log files
grep -i -E "error|critical" /var/log/syslog

17. awk — Pattern Scanning & Column Extraction

A powerful data extraction tool for parsing structured columns in web logs and CSV files.

Terminal Command
# Extract Client IP (column 1) and HTTP Status Code (column 9) from Nginx access log
awk '{print $1, $9}' /var/log/nginx/access.log | head -n 10

18. sed — Stream Editor for In-Place Replacement

Performs text search, find-and-replace, and line filtering in automated scripts.

Terminal Command
# Replace DB_HOST value in-place (-i) inside configuration file
sed -i 's/DB_HOST=localhost/DB_HOST=10.0.1.50/g' .env

19. head & tail — Inspect File Margins & Live Log Streaming

Reads the first or last lines of a file, or streams live file appends in real time.

Terminal Command
# Stream live log appends continuously (-f) showing last 50 lines
tail -f -n 50 /var/log/app.log

20. cat & tac — Concatenate & Print Content

Reads and displays entire file contents in forward (cat) or reverse (tac) line order.

Terminal Command
# Print OS distribution release version
cat /etc/os-release

21. less — Paginated Log Viewer

Opens large multi-gigabyte log files without loading the full file into system RAM.

Terminal Command
# Open log file and jump directly to the bottom (+G)
less +G /var/log/production.log

22. wc — Word, Line & Character Counter

Counts total lines, words, or bytes in text files or piped outputs.

Terminal Command
# Count total lines of error occurrences in access log
grep "500" /var/log/nginx/access.log | wc -l

23. sort & uniq — Duplicate Filtering & Frequency Ranking

Sorts text lines and counts unique occurrences (ideal for top IP analysis).

Terminal Command
# Find top 5 IP addresses requesting your web server
awk '{print $1}' /var/log/nginx/access.log | sort | uniq -c | sort -nr | head -n 5

24. cut & tr — Field Extraction & Character Translation

Splits text by delimiter or translates characters (e.g. converting lowercase to uppercase).

Terminal Command
# Extract system usernames from /etc/passwd using ':' as delimiter
cut -d':' -f1 /etc/passwd

⚡ Category 4: Process Management & System Resource Monitoring

Managing active processes, terminating hung services, and monitoring CPU/RAM bottlenecks.

25. ps — Process Status Snapshot

Displays a snapshot of running processes, user ownership, CPU/RAM usage, and PIDs.

Terminal Command
# List all running processes formatted with full command paths
ps aux | grep java

26. top & htop — Real-Time Task Manager

Provides a dynamic, interactive dashboard of system load, processes, memory, and CPU usage.

Terminal Command
# Non-interactive top batch mode for scripts (-b -n 1)
top -b -n 1 | head -n 20

# Launch interactive htop (if installed)
htop

27. kill, pkill & killall — Process Termination

Sends signals (e.g. SIGTERM -15, SIGKILL -9) to stop running processes by PID or process name.

Terminal Command
# Force kill process by PID
kill -9 12345

# Kill process by name pattern
pkill -f uvicorn

28. nice & renice — Process Priority Tuning

Adjusts CPU scheduling priority (niceness value from -20 highest to 19 lowest).

Terminal Command
# Increase CPU priority for PID 5678 (higher priority)
renice -n -10 -p 5678

29. nohup & & — Background Execution Across Hangups

Executes commands in the background that persist even if SSH sessions disconnect.

Terminal Command
# Run python app in background immune to hangups
nohup python3 app.py > app.log 2>&1 &

30. jobs, fg & bg — Job Control

Lists suspended background jobs and shifts tasks between foreground and background.

Terminal Command
# List active background shell jobs
jobs -l

# Bring job 1 to foreground
fg %1

31. systemctl — Systemd Service Manager

Controls system services, daemon reloads, and boot initialization scripts.

Terminal Command
# Enable and start Docker service
sudo systemctl enable --now docker

# Check status of Nginx service
systemctl status nginx

🌐 Category 5: Networking, Security & Diagnostic Utilities

Testing network connectivity, checking open listening ports, and inspecting HTTP API endpoints.

32. ping — Network Connectivity ICMP Test

Tests network reachability to remote hosts via ICMP Echo Request packets.

Terminal Command
# Send 4 ICMP echo packets to test connection
ping -c 4 google.com

33. curl — HTTP & REST API Transfer Utility

Transfers data over HTTP, HTTPS, FTP, and REST APIs with custom headers and payloads.

Terminal Command
# Send HTTP POST request with JSON body and verbose headers
curl -iv -X POST http://localhost:8000/api/v1/predict \
  -H "Content-Type: application/json" \
  -d '{"experience": 5, "current_lpa": 8}'

34. wget — Non-Interactive File Downloader

Downloads packages and files directly from HTTP/HTTPS URLs with resume support.

Terminal Command
# Download file with resume capability (-c)
wget -c https://releases.hashicorp.com/terraform/1.5.0/terraform_1.5.0_linux_amd64.zip

35. ss & netstat — Socket & Port Listening Audit

Displays active TCP/UDP listening sockets and connected network endpoints.

Terminal Command
# Show listening TCP/UDP ports (-tuln) with process names (-p)
sudo ss -tulnp

36. lsof — List Open Files & Port Owners

Identifies which processes have opened specific files, devices, or network ports.

Terminal Command
# Find process listening on port 8080
sudo lsof -i :8080

37. dig & nslookup — DNS Lookup & Domain Resolution

Queries DNS name servers for A records, CNAMEs, MX records, and propagation status.

Terminal Command
# Query A record of domain name
dig +short A clouddevopshub.com

38. traceroute — Packet Network Hop Path Tracer

Traces the network path and router hops packets take to reach a destination address.

Terminal Command
# Trace hop route to DNS server
traceroute 8.8.8.8

39. ip — Network Interface & Routing Table Manager

Modern replacement for ifconfig to manage IP addresses, interfaces, and routes.

Terminal Command
# Show network interface IP addresses
ip addr show

# Show default gateway routing table
ip route

40. nc (Netcat) — Swiss Army Knife for Ports & Connections

Reads and writes data across network connections, useful for port connectivity testing.

Terminal Command
# Test if remote database port 3306 is open with 3s timeout
nc -zvw3 10.0.1.50 3306

🔒 Category 6: User Permissions, Access Control & Security

Managing file modes, user groups, and SSH remote authentication.

41. chmod — File Permission Modification

Changes file read (4), write (2), execute (1) access rights for Owner, Group, and Others.

Terminal Command
# Grant owner read/write/execute, group & others read/execute
chmod 755 deploy.sh

# Secure private SSH key file (read-only by owner)
chmod 600 id_rsa

42. chown & chgrp — File Ownership Assignment

Changes user owner and group owner of files or directory trees.

Terminal Command
# Recursively change ownership of /var/lib/jenkins to user jenkins and group jenkins
sudo chown -R jenkins:jenkins /var/lib/jenkins

43. useradd & usermod — User Account & Group Management

Creates new system users and updates group memberships.

Terminal Command
# Add jenkins user to docker group
sudo usermod -aG docker jenkins

44. sudo & su — Superuser Privilege Execution

Executes commands with root privileges or switches shell user context.

Terminal Command
# Run psql prompt as postgres service user
sudo -u postgres psql

45. ssh, scp & rsync — Secure Remote Access & File Sync

Connects securely to remote servers, copies files, and synchronizes directory trees incrementally.

Terminal Command
# SSH using private key identity file
ssh -i key.pem ubuntu@54.210.12.34

# Fast incremental directory synchronization with compression (-z) & progress (-P)
rsync -avzP -e "ssh -i key.pem" /local/app/ ubuntu@54.210.12.34:/opt/app/

🛠️ Category 7: Package Management, Cron & Automation Utilities

Installing software dependencies, scheduling background cron tasks, and auditing Systemd logs.

46. apt / yum / dnf — Package Managers

Installs, updates, and removes system software packages on Ubuntu/Debian or RHEL/CentOS.

Terminal Command
# Update package list and install git and curl on Ubuntu
sudo apt update && sudo apt install -y git curl

47. crontab — Scheduled Cron Job Management

Schedules periodic background tasks to run automatically at specific times or intervals.

Terminal Command
# Edit user crontab schedule
crontab -e

# Example cron entry running backup script daily at 2:00 AM:
# 0 2 * * * /opt/scripts/db_backup.sh >/dev/null 2>&1

48. journalctl — Systemd Service Journal Auditor

Queries and filters logs generated by Systemd services and system daemons.

Terminal Command
# View last 100 log lines of Docker service without pagination
journalctl -u docker.service -n 100 --no-pager

49. alias — Custom CLI Command Shortcuts

Creates short aliases for long CLI commands to boost daily terminal productivity.

Terminal Command
# Add shortcut alias for kubectl
alias k="kubectl"
alias dps="docker ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'"

50. history — Shell Execution History Auditor

Lists previous commands executed in the current shell session.

Terminal Command
# Search history for previous docker commands
history | grep "docker run"

❓ Frequently Asked Questions (FAQ) & Interview Guide

Common real-time Linux interview and operational questions for DevOps Engineers:

Q1: What is the difference between Load Average and CPU Utilization in Linux?

Answer: CPU Utilization measures the percentage of time CPU cores are active processing tasks. Load Average (seen in uptime or top) measures the average number of processes in runnable or uninterruptible state (waiting for CPU or disk I/O) over 1, 5, and 15 minute intervals. A load average exceeding total CPU core count indicates queue bottlenecks.

Q2: How do you troubleshoot a server running out of disk space when `df` shows 100% full?

Answer: 1. Run du -sh /* | sort -hr to locate large directories.
2. If du shows normal space but df shows 100% full, check for deleted files held open by active processes using lsof +L1.
3. Restart the process holding the deleted file handle to release the disk blocks.

Q3: What is the difference between SIGTERM (-15) and SIGKILL (-9) when stopping processes?

Answer: SIGTERM (-15) requests a graceful process shutdown, allowing the application to close database connections, release locks, and cleanup temporary files. SIGKILL (-9) forcefully terminates the process immediately at the kernel level without cleanup.

Q4: Why is `rsync` preferred over `scp` for copying large directories?

Answer: rsync uses a delta-transfer algorithm to copy only modified or new files, supports automatic compression (-z), preserves file permissions and symlinks, and allows resuming interrupted transfers (-P), unlike scp which recopies everything from scratch.

Q5: How do you check if a specific port (e.g., 3306) is listening and accepting traffic on a remote server?

Answer: On the local/client machine, run nc -zvw3 3306 or curl -v telnet://:3306. On the remote server itself, verify with sudo ss -tulnp | grep 3306.

🐧
Cloud DevOps Hub Production Linux System Administration & CLI Reference Guide